T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:38- Finding
Untrusted Learning Content Can Poison Persistent Agent Instructions and Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
Learning Review
Security checks for vulnerabilities and agentic risk
Overview
The skill is a learning-review helper, but it can automatically and silently change persistent agent instructions, memory, skills, and archived notes.
Install only if you are comfortable with a review workflow that may change long-lived agent behavior files and move learning notes. Prefer running it manually or in a propose-only mode, reviewing diffs before any updates to AGENTS.md, TOOLS.md, SOUL.md, MEMORY.md, memory/, or Skill files.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest lists very short, generic trigger phrases such as "回顾", "复盘", and "内化". These terms are common in everyday discussion and do not clearly limit invocation to this specific learning-review workflow, increasing the chance of accidental activation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This section instructs the agent to update core workspace files such as AGENTS.md, TOOLS.md, SOUL.md, memory/, and MEMORY.md without an explicit confirmation or warning that persistent project state will be changed. Because these files can influence future agent behavior and workspace state, automatic modification creates a prompt-to-persistence risk and may let unreviewed learning content alter long-term instructions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The archive/compress workflow directs moving content out of inline files and relocating notes from learning/notes/ to learning/archive/ without an explicit safety warning, confirmation step, or rollback guidance. Even if intended as maintenance, this can cause loss of visibility, broken references, or effectively irreversible workspace changes if the agent archives the wrong material.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The weekly cron template explicitly authorizes automatic updates to core agent context files and memory stores as part of a review workflow. That turns a reflective learning process into a self-modifying mechanism, which can silently alter future agent behavior, persist bad inferences, or propagate poisoned content from notes into trusted control files.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This section describes silent, data-affecting actions including editing core files and moving notes without clearly warning the user or requiring confirmation. Even if intended for maintenance, undisclosed repository mutation increases the chance of accidental data loss, hidden state drift, and unauthorized changes in automated contexts.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The archive workflow permits direct edits to inline system-context files and movement of source notes, which can both change agent behavior and destroy or hide provenance. Because the task is scheduled and silent, a faulty or adversarial interpretation of what is 'already internalized' or 'outdated' could remove critical context and replace it with lossy summaries or pointers.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This template instructs the system to update core files and skills automatically, but does not disclose that it will mutate trusted repository assets. Lack of transparency around policy and skill changes is dangerous because it can alter agent behavior in persistent ways without user awareness or review.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The knowledge-integration template authorizes direct modification of AGENTS.md or skills based on recent notes and reviews. This creates a direct path from untrusted or weakly validated learning material into executable agent policy and capability definitions, enabling persistence of mistakes, prompt injection content, or unsafe operating rules.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The repeated instruction to execute silently is a natural-language behavioral policy embedded in the file. While not a language-setting issue, it imposes a fixed communication mode without any opt-in or justification, which can be a policy concern if users expect notification or transparency.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file presents all headings, instructions, and examples exclusively in Chinese, which imposes a specific language on users. Under the natural-language policy rules, a forced language choice without opt-in or justification is a policy concern.
- Content
Static analysis
No suspicious patterns detected.